JP2002288030A - Program for prohibition of data taking-out - Google Patents

Abstract

PROBLEM TO BE SOLVED: To use a confidential file prohibited from being taken out to the external and other files in a mixed state. SOLUTION: When an application program 30 opens a confidential file stored in a predetermined confidential holder, the movement of the contents of the opened file is controlled so as not to output the contents of the file to the external excluding the confidential file. For example, the confidential file is prohibited from being stored in holders excluding the confidential holder by the application program. When the contents of the file are transferred to another file opened by another application file, the other file is similarly prohibited from being stored in the holders excluding the confidential holder. When the application program opens a file in a holder excluding the confidential holder, the output of the contents of the file to the holder excluding the confidential holder is permitted.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for prohibiting a secret information file stored in a data processing device from being taken out of the data processing device, and a program therefor.

[0002]

2. Description of the Related Art In an organization such as a company, much of the information used daily in business must be kept confidential outside the organization. In addition, the employee has a duty to display a confidential file containing confidential information on a display device of a data processing device such as a personal computer (PC) or a workstation and to browse and generate a new confidential file containing the confidential information. Often there. For example, when developing equipment or programs, employees refer to confidential information, design data developed by others,
The design data is changed to generate new design data that is a new confidential file.

[0003] With respect to a highly sensitive confidential file, an employee is prohibited from outputting the confidential file to the outside of a data processing device used by the employee. For example, it is possible to output a copy of the confidential file to a portable recording medium such as a floppy disk, print the contents of the confidential file, and attach the confidential file to an e-mail. Not done.

[0004]

The data processing device used by the employee who refers to the highly confidential confidential file has an external output function, that is, a file output function to a recording medium such as a floppy disk, and a printer. It is desirable to prohibit the file transfer function and the file transfer function by e-mail.

[0005] However, employees often process other files containing less confidential or less confidential information with the data processing device. The other files are allowed to be output to a recording medium such as a floppy disk, printed, and attached to an e-mail.

In order to manage the highly confidential confidential file, the data processing device used by the employee has an external output function, that is, a function of outputting a file to a recording medium such as a floppy disk, and printing of a file by a printer. function,
If the file transfer function is disabled by e-mail, the employee will not be able to use the external output function for the other files as well, which means that employees will not be able to use the other files. Undesirable for the promotion of.

Therefore, an object of the present invention is to provide a data processing apparatus having a storage device in which a confidential file that should not use the external output function and another file that may use the external output function are mixed and stored. A data export prohibition method, wherein the device allows the use of the external output function for a confidential file for which the external output function is not to be used, and permits the use of the external output function for the other file. And a program therefor.

[0008]

According to a program according to the present invention, when any application program requests to open any file stored in a storage device, the file is determined in advance in the storage device. It is determined whether the file is stored in the confidential information storage folder, and if the file is determined to be a file stored in the confidential information storage folder, the content of the file is A program for causing a computer to execute a step of restricting movement of contents of the file after the file is opened so that the file is not output to a folder other than the confidential information storage folder.

Thus, after a certain application program opens a file stored in the confidential information storage folder, the file can be prevented from being output to the confidential information storage folder by the application program. . For example, storing the file in a folder other than the confidential information storage folder in the storage device is prohibited. Or,
The output of the file to a storage device other than the storage device is prohibited. Alternatively, printing of the file by the application program is prohibited.

[0010] More specifically, the step of restricting includes, when it is determined that the file is a file stored in the confidential information storage folder, the application program is opened after the file is opened. When transferring at least part of the file to another file opened by another application program using the data transfer function between application programs,
Restricting the movement of the content of the other file after the data transfer so that the content of the other file is not output to a folder other than the confidential information storage folder.

Thus, it is possible to prohibit a file in the confidential information storage folder from being moved outside the folder via the another application program. For example, when the other application program later requests to save the other file, whether or not the file saving destination specified by the saving request is in the confidential information saving folder in the storage device If the file storage destination is outside the confidential information storage folder, the storage request is invalidated.

[0012]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, an embodiment of a method for prohibiting taking-out of confidential files and a program therefor according to the present invention will be described in detail with reference to the drawings.

FIG. 1 is a block diagram of a computer system using one embodiment of a method for prohibiting the removal of a confidential file and a program therefor according to the present invention.
The computer system is a system used inside an organization such as a company. In the figure, reference numeral 10 denotes an example of a computer used by an employee user of a company, for example, which is constituted by a personal computer (PC). Computer 1
0 may be a workstation. 10A is a computer used by another employee user, and has the same structure as the computer 10. Reference numeral 20 denotes an example of a server computer, and the computers 10, 10A, and 2
0 is connected to a network 23 such as a LAN, for example. Reference numeral 21 denotes an example of a network printer connected to the network 23;
1 is an example of a network drive such as a magnetic disk storage device connected to a computer.

The computer 10 includes a memory 11, a display device 12, a central processing unit (CPU) 13, and an input device 1 having a pointing device such as a keyboard and a mouse.
4, an auxiliary storage device 15, such as a magnetic storage device, a floppy disk drive device 16, and a bus 1 connecting these devices
7 and a network interface card 18 for connecting the bus 17 and the network 23. A separate printer 19 may be connected to the computer 10 via the bus 17. Further, a drive for a removable medium other than the floppy disk drive 16 may be connected to the bus 17, but such a drive is not shown here for simplification. In the following description, the floppy disk drive 16 will be described as an example of a drive for a removable medium. That is, the description given below with respect to the floppy disk drive 16 also applies to drives for other removable media.

The computer 10, 10A is applied with the method for prohibiting taking out confidential files according to the present invention, and further uses a program for the method. Computer 1
0, a plurality of application programs 30, 31,... Are mounted in the memory 11, and the execution of those application programs is performed by the operating system (O
S) Controlled by 40. The OS 40 can be realized by improving a known OS such as Windows (registered trademark). That is, the OS 40 is a well-known API (Applicatio) constituting a conventional OS.
The present invention is realized by adding an I / O monitoring program 42, a security management table 45, and a security file registration table 46 to the subsystem 41, the kernel system 43, and the shared data area 44 according to the present invention. .

Further, each application program 3
The filter programs 32, 33,... Prepared according to the present invention corresponding to 0, 31,. The filter programs 30, 31,... Are prepared so that when each application program is started, a correspondingly prepared filter program is started. In the following, for simplicity of explanation, each application program
It is described that the corresponding filter program is installed.

The OS 40 includes a well-known shared data area 44 used for data transfer between application programs, and a security management table 45 and a security file registration table 46 are newly provided according to the present invention.

Before describing the details of the computer system, an outline of its operation will be described. The administrator of the present system can set the computer 10 used by the user to the secret file export prohibition mode or reset the setting. The system administrator sets a confidential folder 15A for storing a specific confidential file in the auxiliary storage device 15 in the computer 10 used by each user, and stores a plurality of confidential files used by the user in the business. Save in. After that, the computer 10 is set to the confidential information take-out prohibition mode, and the user is made to use the computer 10.

The API subsystem 41 in the OS 40 includes:
The API system provides an application program interface (API) to the application program.
And communicates with the application program 30 and the like. The I / O monitoring program 42 monitors a file input / output request issued by the application program 30 or the like via the API subsystem 41, and if the input / output request attempts to output a confidential file to a folder other than the confidential folder 15A, the Disable file I / O requests.

The filter program 32 or 33 detects a data transfer request issued by the application program 30 or 31, and invalidates the data transfer request when data transfer between the application programs is not permitted. When data transfer between application programs is permitted, the I / O monitoring program 42 is notified of the application program of the data transfer destination and the file of the data transfer destination as a target of the confidential information export prohibition processing.

FIG. 2 is a diagram for explaining the process of prohibiting taking out of a confidential file according to the present embodiment. The user can start the application program 30 and open the confidential file 50A in the confidential folder 15A by the application program 30 (). The user can edit the file 50A by the application program to generate a file 50X having new contents. Since this new file 50X also contains the confidential information in the original confidential file 50A, taking out is prohibited as in the case of the confidential file 50A. That is, the confidential file 50A or the new file 50X cannot be output to an area other than the confidential folder 15A.

For example, after browsing the confidential file 50A or generating the new file 50X, the user may enter the confidential file 50A or the new file 50X.
When an area other than the confidential folder 15A is designated as the storage destination of the application program 30 and the file storage is requested to the application program 30 (), the request is invalidated by the I / O monitoring program 42 and is not executed by the kernel system 43. When the user specifies the confidential folder 15A as a storage destination of the new file 50X and requests the file storage after the generation of the new file 50X, the request is invalidated by the I / O monitoring program 42. It is executed by the kernel system 43.

Similarly, the confidential file 50A or the new file 50X cannot be printed using the individual printer 19 or the network printer 21, and cannot be output to the floppy disk drive 16 or the network drive 22. It cannot be forwarded as an e-mail attachment.

The other application program 31
If another file 50B stored in the folder 15B other than the confidential folder is opened and at least a part of the file opened by the application program 30 is transferred to another application program 31 (), the application program 30 The embedded filter program 32 transmits the source file 50A.
Is a sensitive file. File 50B opened by application program 31
Is a file stored in the folder 15B other than the confidential folder, the I / O monitoring program 42
The other file 50B is also treated as a confidential file like the confidential file 50A opened from the confidential folder 15A. That is, the other file 50B is not output outside the confidential folder 15A.

[0025] For example, if the user sets the other file 50B
When an area other than the confidential folder 15A is designated as the storage destination of the application program 31 and the application program 31 requests the application program 31 to save the file (), the request is invalidated by the I / O monitoring program 42 and is not executed by the kernel system 43. When the user specifies the confidential folder 15A as the storage destination of the other file 50B and requests the application program 31 to save the file, the request is not invalidated by the I / O monitoring program 42, It is executed by the kernel system 43.

The file stored in the folder 15B other than the secret folder in the auxiliary storage device 15 may be a secret file or a non-secret file. With respect to the file 50B stored in the folder 15B other than the confidential folder 15A, the above-described removal prohibition processing is not executed.

As shown in FIG. 3, the filter program 3 embedded in the application program 30
In order to prohibit data transfer between application programs, the operation of prohibiting taking out of a confidential file can be designated in advance. In this case, when the application program 30 requests data transfer to another application program 31, the filter program 32 invalidates the data transfer request.

FIG. 4 shows an example of the security management table 45. The security management table 45 includes a security file transfer prohibition mode storage area 451, a security folder path name storage area 4
52, a data transfer permission flag storage area 453 between application programs. As an initial setting process of the computer 10, the system administrator sets the confidential file transfer inhibition mode bit in the storage area 451 to a value of 1
To indicate that a confidential file transfer prohibition operation should be performed. The storage area 452 stores the path name of the confidential folder (for example, C: \ AAA in the example in the figure).
A value “1” or “0” is set in 53 as a data transfer permission flag between application programs. When the value of the data transfer permission flag between application programs is, for example, “1”, data transfer between application programs is permitted.

In order to realize the prohibition of taking out a confidential file, it is desirable to prohibit data transfer between application programs in order to surely prohibit taking out. However, when a new file is generated by editing a file opened by an application program, it is often convenient to use data in the file opened by another application program. Therefore, it is desirable for a user to be able to use data transfer between application programs even when taking out a confidential file is prohibited.

Usually, two types of data transfer methods are used for transferring data between application programs. That is, data transfer via the shared data area 44 (FIG. 1) (also called a clipboard), object linking and embedding (Object Linking and Embedding)
ding-OLE). In the present embodiment, when data transfer between application programs is prohibited, neither data transfer using the OLE nor data transfer via the shared data area is allowed. When data transfer between application programs is permitted, data transfer using the OLE is permitted, but data transfer via the shared data area is not permitted. In the data transfer using the OLE, data is directly transferred between application programs, so that data transfer control is easy. On the other hand, the shared data area is an area managed by the OS and is accessible from any application program, so that it is not easy to control data transfer. In other words, in order to prevent the confidential file from being taken out, it is easier to realize that the data transfer via the shared data area is not allowed.

FIG. 6 is a schematic flowchart showing an example of the processing of the I / O monitoring program 42. First, it is determined whether a file open event indicating that a request to open any file has been detected (step S421). When the file open event is detected, the file to be opened is stored in the confidential folder 15A. It is checked whether or not the file has been written (step S422). If the file is a file stored in the confidential folder 15A, the combination of the application program and the file is stored in the confidential file registration table 46 (step S423).

FIG. 5 shows an example of the confidential file registration table 46. Each entry 46A, 46B,... Of the confidential file registration table 46 is a set of storage areas 461 and 462.
Consists of The storage area 461 stores the handle name of the application program as identification information of the application program. The handle name is stored as the identification information of the started application program because a plurality of application programs having the same name may be started, and in order to distinguish these application programs, each of the started application programs is distinguished. Is stored in the confidential file registration table 46 as identification information of the application program.

The storage area 462 stores the file path of the file to be opened as identification information of the file to be opened. In this case, the activated file is the confidential folder 15
Assume that it is a file stored in A. The entry 46A in the figure shows an example of the handle name of the started application program and an example of the file path of the opened file. When the open file name is changed to another file name, the file name stored in the storage area 462 is changed to a new file name.

As described above, when the file stored in the confidential folder 15A is first opened on the computer 10, the following processes S424 to S427 are executed.
The contents of the opened confidential file are stored in the confidential folder 15
It is forbidden to take it out of A. These processes S4
Steps S24 to S427 are continuously executed as long as at least one confidential file is opened. However, the contents of steps S424 to S427 will be described later.

When step S427 ends, the process returns to step S421. If a file open event indicating that any application program has requested to open any file is not detected in step S421, the process proceeds to step S428. If it is determined in step S422 that the file to be opened is a file stored in the folder 15B other than the confidential folder 15A, the processing is performed from step S422 to step S42.
Jump to 8.

In step S428, it is determined whether a registration request has been issued from any of the filter programs, for example, 32, to request that the application program be registered in the confidential file registration table 46. This registration request will be described later. here,
Assume that no such registration request has been detected. In that case, in step S429, it is determined whether or not a file storage event requesting that the application program opening the confidential file store the file in the auxiliary storage device 15 is detected. If no file storage event has been detected, the process returns to step S421.

When a file storage event is detected,
In step S430, it is determined whether the set of the application program that generated the file storage event and the file to be stored is registered in the confidential file registration table 46. If it is determined in step S430 that the combination of the application program that generated the file storage event and the file to be stored is not registered in the confidential file registration table 46, the process returns to step S421.

However, if it is determined in step S430 that the set of the application program that generated the file storage event and the file to be stored is registered in the confidential file registration table 46, the process proceeds to step S431. The storage destination is inside the confidential folder 15A (that is, the confidential folder 15A).
A or a folder inside the confidential folder 15A). When the file storage destination is not a folder inside the confidential folder 15A,
The file storage is invalidated (step S43).
2). As a result, the confidential file becomes the confidential folder 1
Output to a folder outside 5A is prohibited.

As described above, when a confidential file in the confidential folder 15A is opened by any application program, even if the file is edited using the application program, the file is stored in a folder other than the original confidential folder 15A. Is not saved in the folder. When it is determined in step S431 that the file storage destination is inside the confidential folder 15A, the I / O monitoring program 42 does nothing to the file storage, and the file storage is executed as it is. .

In the above description, the confidential folder 15
In the case where the confidential file in A is opened by the application program and stored thereafter, it is prohibited to store the opened file on the floppy disk via the floppy disk drive 16 in the same manner. Is done. Further, storing the opened file in the network drive 22 (FIG. 1) is also prohibited. Further, the opened file is stored in the individual printer 19.
Alternatively, printing by the network printer 21 is also prohibited. Further, attachment of the opened file to an e-mail is also prohibited.

The above-described prohibition processing is performed when the file opened by the application program is a file stored in the confidential folder 15A. The opened file is a folder 15B other than the confidential folder 15A.
If the file is stored in the file, the above-described processing for prohibiting taking out of the file is not performed on the file, and the user can perform the processing for prohibiting taking out of the file without being affected by the processing for prohibiting taking out of the file. Can be used.

The contents of steps S424 to S427, the description of which has been omitted, are as follows. First, in step S424, the shared data area 44 (FIG. 1) is locked. As already described, the shared data area 44
Is also called a click board and can be used for data transfer between application programs. If the shared data area 44 is available, the contents of the confidential file can be stored in a folder other than the confidential folder 15A using a plurality of application programs.

For example, when another file in the folder 15B other than the confidential folder 15A is opened by another application program while a confidential file in the confidential folder 15A is opened by an application program, the confidential file is opened. The content of the file can be copied to the shared data area 44, and the copied content can be pasted to the other file.

In this embodiment, when the contents of the confidential file are transferred to another file via the common data area, the other file is stored in the confidential folder 15.
In order to prohibit the file from being stored in a folder other than folder A, when any one of the confidential files in the confidential folder 15A is opened by any of the application programs, the application program using the shared data area 44 is used. The shared data area 44 is locked so that data cannot be transferred between them.

FIG. 7 is a diagram schematically showing a mechanism in which the I / O monitoring program 42 locks the shared data area 44. The I / O monitoring program 42 can lock the shared data area 44 when the application program # 1 (30) or the application program # 2 (31) opens the confidential file 50A from the confidential folder 15A. That is, when a plurality of files are open, the shared data area 44 is closed and cannot be used. When the application program # 1 (30) or the application program # 2 (31) closes the confidential file 50A, the lock on the shared data area 44 is released. That is, when the total number of open files is one, the shared data area 44 is opened and the file can be used.

Returning to FIG. 6, in step S425, the contents of the file displayed by the application program are prohibited from being copied as screen data to another file using the screen capture tool. That is, the screen capture tool uses the library function GDI
32 is prohibited from being executed in step S425. FIG. 8 is a diagram schematically illustrating a mechanism in which the I / O monitoring program locks the taking out of data by screen capture. Screen capture tool 501
Uses a library function (for example, GDI32) (502) for acquiring screen information (502).
Deo Adapter) 503 has a function of acquiring screen information.

The I / O monitoring program 42 includes a screen capture tool 501 and a library function GDI 32 (50
The screen capture tool 501 functions as a filter program inserted in the middle of 2), and the library function GD
Monitor calling I32 (502). When the application program opens the confidential file, that is, in step S425, the library function GDI32 (502) by the screen capture tool 501 is used.
Lock the call to That is, the library function cannot be called by the screen capture tool 501. As a result, when at least one confidential file is opened by any of the application programs, the screen capture is not executed.

Returning to FIG. 6, in step S426, recording of user operations and input / output processing in the computer 10 is started as an access log, and in step S427,
The recording of the computer 10 and its surroundings, including the operator of the computer 10 and the screen of the display device, is started using a monitoring camera (not shown). Then, based on the access log and the recording information of the surveillance camera, the administrator allows the user of the computer 10 to use a character input device such as a keyboard to input the contents of the confidential file displayed on the screen of the display device 12 (FIG. 1). You can check that you have not entered any other files.

In this embodiment, when the system administrator sets the data transfer permission flag between application programs stored in the storage area 453 in the security management table 45 (FIG. 5) in the initial setting, the OLE
Can be used for data transfer between application programs.

FIG. 9A is a view for explaining a data transfer method by OLE using a drag / drop function. Drag the object 51 displayed on the window 205 of the application program # 1 (30) using a pointing device such as a mouse,
When drop is specified on the window 206 of another application program # 2 (31), the object 51 is transferred from the application program # 1 (30) to the application program # 2 (31) using the OLE data transfer interface. Object 5 on the window of 2 (31)
Transferred as 2.

FIG. 5B is a diagram showing a data transfer method by OLE using an object insertion function.
The file displayed on the window 205 of the application program # 1 (30) is stored in the window 206 of another application program # 2 (31).
By specifying the object to be inserted from the nsert menu, the application program #
2 can be displayed on the second window 206.

When such data transfer between the application programs is permitted, for example, the application program # 1 (30) opens the confidential file in the confidential folder 15A, and the application program # 2 opens the confidential file in the folder 15B other than the confidential folder. With the file open, all or part of the confidential file opened by the application program # 1 can be transferred to the file opened by the application program # 2 using OLE data transfer.

When the contents of the confidential file in the confidential folder 15A are transferred to the file opened from the other folder 15B by using the data transfer between the application programs, in this embodiment, the other file is used. Is controlled so that files cannot be stored in folders other than the confidential folder 15A. For this purpose, an activated application program, for example 3
0, a filter program 32 is prepared, and when the application program 30 is started, the corresponding filter program 32 is started, and the filter program 32 and the I / O monitoring program 42 cooperate with each other to generate data by OLE. It operates so that the file containing the confidential information transferred by the transfer is not stored in the folder 15B other than the confidential folder 15A.

FIG. 10 is a schematic flowchart showing an example of the processing of a filter program incorporated in each application program. The filter program, for example, 32, monitors an API call issued by the application program 30 incorporating the filter program to the API subsystem 41, and transfers data from the application program 30 to another application program. It waits for the occurrence of a data transfer event between application programs (step S321).

When the filter program 32 detects the occurrence of this event, information on the set of the application program 30 in which the filter program 32 is incorporated and the file opened by the application program is registered in the confidential file registration table 46. It is determined whether or not it is (step S322). As described above, when the file opened by the application program 30 is the confidential file stored in the confidential folder 15A, the above information is registered in the confidential file registration table 46.

The above information is stored in the confidential file registration table 46.
Is not registered in the secret folder 15A, the file transferred by the detected application-to-application-program data transfer event is not a file stored in the confidential folder 15A, and the filter program 32 does nothing, and the process returns to step S321. .

The above information is stored in the confidential file registration table 46.
If it has been registered, it is checked whether data transfer between application programs is permitted in the computer (step S323). This check is performed based on whether or not the data transfer permission flag between application programs is set in the storage area 453 in the security management table 45 (FIG. 5). As described above, the data transfer permission flag between application programs is set or reset in advance by the system administrator.

If the data transfer permission flag between the application programs is set, a request is made to the I / O monitoring program 42 to register the destination application program (step S325). The filter program 32 notifies the I / O monitoring program 42 of the handle name of the destination application program and the file path of the destination file used at the time of registration. The processing of the filter program 32 then returns to the initial processing S321.

Referring to FIG. 6, when the I / O monitoring program 42 detects a request to register an application program from the filter program in step S428, the process proceeds to step S423, where the requested application program is stored in a confidential file. Register in the registration table 46. In this case, the destination application program, for example, a set of the handle name of 31 and the file path of the destination file is added to the confidential file registration table 46.

The confidential file registration table 4 shown in FIG.
6 shows an example of the added handle name and file path in the second entry 46B. Thus, when data is transferred from an application program that has opened a confidential file to another application program, the application program of the data transfer destination is also registered in the confidential file registration table 46 as a monitoring target. Thus, the destination application program 3
1 and the destination file are registered in the confidential file registration table 46 in the same manner as when a confidential file is opened from the confidential folder 15A.

Later, when the destination application program 31 issues a request to store the destination file, the I / O monitoring program 42 detects a file storage event in connection with this request. When the I / O monitoring program 42 detects a file storage event (step S429), it is determined in step S430 whether the application program is registered in the confidential file registration table 46, as described with reference to FIG. You.

In this determination, it is determined that the data transfer destination application program 31 is registered. Therefore, when the storage destination specified by the application program 31 of the data transfer destination is a folder other than the confidential folder 15A, the process proceeds to step S43.
In 2, the file storage is invalidated. In this way, the data transfer destination file is prohibited from being stored in a folder other than the confidential folder.

As described above, the application program 31 of the data transfer destination stores the confidential file registration table 4
6, the application program 31 of the data transfer destination is processed in the same manner as the application program that opened the confidential file from the confidential folder 15A.

As described above, while allowing the contents of the confidential file in the confidential folder 15A to be transferred to the transfer destination file by data transfer between application programs, the transfer destination file is stored in a folder other than the confidential folder 15A. Can be prohibited. The same applies to the printing of the data transfer destination file, the output to the recording medium in the floppy disk drive 16, the output to the network drive 22, and the attachment to the e-mail.

The processing S3 of the filter program 32
If it is determined at 23 (FIG. 10) that the data transfer permission flag 453 (FIG. 4) between application programs is not set, data transfer between application programs is locked (step S32).
4). That is, the generated data transfer event between application programs is invalidated, and an error message is displayed. In this case, data transfer between application programs is not used.

The present invention is not limited to the above embodiments, but may be modified or modified without departing from the scope of the present invention. For example, in order to prohibit the removal of confidential information, when the application program that has opened the confidential file terminates, all files used by the application program remaining in a cache memory (not shown) of the computer 10 are deleted. It is desirable to do so.

It is also desirable to encrypt confidential files in the confidential folder. In this case, when opening a confidential file in the confidential folder from the application program, the file is decrypted and transferred to the application program. Also, if the application program stores files in a confidential folder,
Store the file after encrypting it.

[0068]

As described above, according to the present invention, in a computer having a storage device in which a confidential file to be prohibited from being taken out and other files which are not so stored are mixed, The confidential file can be prevented from being output to a folder other than the confidential folder specified in advance, and the other file can be output to a folder other than the confidential folder.

[Brief description of the drawings]

FIG. 1 is a block diagram of a computer system using a confidential file export prohibition method and a program according to an embodiment of the present invention.

FIG. 2 is a diagram illustrating a process of prohibiting taking out of a confidential file.

FIG. 3 is a diagram for explaining a removal prohibition process for a confidential file in a state where data transfer between application programs is prohibited.

FIG. 4 is a diagram showing an example of a security management table.

FIG. 5 is a diagram illustrating an example of a confidential file registration table.

FIG. 6 is a schematic flowchart illustrating an example of processing of an I / O monitoring program.

FIG. 7 is a diagram schematically illustrating a mechanism in which an I / O monitoring program locks a shared data area.

FIG. 8 is a diagram schematically illustrating a mechanism in which an I / O monitoring program locks the taking out of data by screen capture.

FIG. 9 is a diagram illustrating data transfer using object link and embedding (OLE).

FIG. 10 is a schematic flowchart illustrating an example of processing of a filter program incorporated in an application program.

 ────────────────────────────────────────────────── ─── Continuing from the front page (72) Inventor Yoshiki Samejima 6-81 Ouecho, Naka-ku, Yokohama-shi, Kanagawa Prefecture Hitachi Software Engineering Co., Ltd. In-house F-term (reference) 5B017 AA06 BA06 CA16 5B082 EA07 EA11 5B098 GA01 GC16 JJ08

Claims (9)

[Claims] When any application program requests to open any file stored in a storage device, the file is stored in a predetermined confidential information storage folder in the storage device. If the file is determined to be a file stored in the confidential information storage folder, the content of the file is not output to a folder other than the confidential information storage folder. A program for causing a computer to execute the steps of restricting movement of the content of the file after the file is opened. 2. The method according to claim 1, wherein, if the file is determined to be a file stored in the confidential information storage folder, the application program stores the file after the file is opened. Requesting that the file storage destination specified by the storage request is in the confidential information storage folder in the storage device, and determining whether the file storage destination is outside the confidential information storage folder. 2. The program according to claim 1, further comprising the step of invalidating the storage request. 3. The method according to claim 1, wherein the limiting step includes transferring at least a part of the file opened by the application program to another file opened by another application program using an inter-application-program data transfer function. The program according to claim 1, further comprising a step of prohibiting. 4. The program according to claim 1, wherein the restricting step includes a step of prohibiting execution of screen capture for the contents of the file opened by the application program. 5. The method according to claim 5, wherein, if it is determined that the file is a file stored in the confidential information storage folder, the application program executes at least one of the files after the file is opened. When the data is transferred to another file opened by another application program using the inter-application-program data transfer function, the data transfer is performed so that the contents of the other file are not output to the folder other than the confidential information storage folder. The program according to claim 1, further comprising a step of restricting a movement of the content of the another file after the step (c). 6. The restricting step, wherein, when the another application program later requests to save the other file, the file save destination specified by the save request is the secret stored in the storage device. Determining whether or not the file is in an information storage folder; and invalidating the storage request when the file storage destination is outside the confidential information storage folder. The described program. 7. When any application program requests to open any file stored in the storage device, the file is stored in a predetermined confidential information storage folder in the storage device. Whether or not the file is a file stored in the confidential information storage folder, the combination of the application program and the file as an object to be confidentially managed. When any one of the application programs requests that the contents of a file in which the application program is opened be moved to a folder other than the confidential information storage folder, the set of the application program and the file is subjected to security management. Whether it is memorized as an object Another and, when the set of the application program and the file is stored as the confidential managed program to be executed to disable the movement request, the steps on a computer. 8. An application program opening any file issues a request to transfer at least a portion of the file to another file opened by another application program using the inter-application program data transfer function. At this time, it is determined whether or not the combination of the application program and the file is stored as an object to be managed with confidential information, and the combination of the application program and the file is stored as an object to be managed with confidential information. 8. The program according to claim 7, further comprising the step of: storing the combination of the other application program and the other file as an object to be confidentially managed when it is determined that 9. The method according to claim 9, wherein: when any application program opening any file requests storage of the file, a combination of the application program and the file is set as a subject to be confidentially managed. It is determined whether or not the file is stored, and when it is determined that the combination of the application program and the file is stored as an object to be confidentially managed, the file storage destination specified by the storage request is the confidential file. Determining whether or not the file is stored in an information storage folder, and invalidating the storage request when the file storage destination is outside the confidential information storage folder. 8. The program according to 8.